Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 343723dd authored by Jiri Pirko's avatar Jiri Pirko Committed by David S. Miller
Browse files

net: sched: fix clsact init error path 



Since in qdisc_create, the destroy op is called when init fails, we
don't do cleanup in init and leave it up to destroy.
This fixes use-after-free when trying to put already freed block.

Fixes: 6e40cf2d ("net: sched: use extended variants of block_get/put in ingress and clsact qdiscs")
Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c05fad57

net/sched/cls_api.c

+2 −2
Original line number Diff line number Diff line
@@ -351,6 +351,8 @@ void tcf_block_put_ext(struct tcf_block *block, struct Qdisc *q, 
{

	struct tcf_chain *chain;



	if (!block)

		return;

	/* Hold a refcnt for all chains, except 0, so that they don't disappear

	 * while we are iterating.

	 */
@@ -377,8 +379,6 @@ void tcf_block_put(struct tcf_block *block) 
{

	struct tcf_block_ext_info ei = {0, };



	if (!block)

		return;

	tcf_block_put_ext(block, block->q, &ei);

}

net/sched/sch_ingress.c

+1 −5
Original line number Diff line number Diff line
@@ -190,7 +190,7 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt) 


	err = tcf_block_get_ext(&q->egress_block, sch, &q->egress_block_info);

	if (err)

		goto err_egress_block_get;

		return err;



	net_inc_ingress_queue();

	net_inc_egress_queue();
@@ -198,10 +198,6 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt) 
	sch->flags |= TCQ_F_CPUSTATS;



	return 0;



err_egress_block_get:

	tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info);

	return err;

}



static void clsact_destroy(struct Qdisc *sch)